CVE-2008-1198: High severity red hat enterprise linux vulnerability
Description of problem:
The default IPSec ifup script (/etc/sysconfig/network-scripts/ifup-ipsec) initializes the racoon configuration to use aggressive IKE mode, then fallback to main IKE mode if that fails:
... remote $DST { exchangemode aggressive, main; ...
Due to widely known attacks, the aggressive mode should be only used when public key authentication is in use. In practice, most administrators use IPSec with PSK authentication, which combined with aggressive mode leads to aforementioned vulnerability.
See this whitepaper for more information: http://www.netsc.ch/IMG/pdf/TargetingIKEen.pdf
The exchangemode should be changed to "main" only or, for a low-security fallback, to "main, aggressive" (in the opposite order than currently).
Other sources
The default IPSec ifup script in Red Hat Enterprise Linux 3 through 5 configures racoon to use aggressive IKE mode instead of main IKE mode, which makes it easier for remote attackers to conduct brute force attacks by sniffing an unencrypted preshared key (PSK) hash.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1198?
CVE-2008-1198 is classified as a medium severity vulnerability due to its potential to allow unauthorized access through insecure configuration.
What systems are affected by CVE-2008-1198?
CVE-2008-1198 affects Red Hat Enterprise Linux versions 3.0, 4.0, and 5.0.
How do I fix CVE-2008-1198?
To mitigate CVE-2008-1198, disable aggressive IKE mode in the racoon configuration or upgrade to a patched version of the software.
What is the main issue with CVE-2008-1198?
The main issue with CVE-2008-1198 is that it allows a fallback to a vulnerable aggressive IKE mode that is susceptible to known attacks.
Is there a workaround for CVE-2008-1198?
A potential workaround for CVE-2008-1198 is to manually adjust the IPSec ifup script to prioritize secure modes over aggressive ones.